Thanks! Looking on the planned API/CLI, besides the typo ("prinicpal"), I also
see that you are using the Kerberos attributes in the raw name
("--krbprincipalname"). This is not consistent with the CLI form when they are
used in other commands:
...
Str('krbprincipalname?', validate_principal,
cli_name='principal',
label=_('Kerberos principal'),
default_from=lambda uid: '%s@%s' % (uid.lower(), api.env.realm),
autofill=True,
flags=['no_update'],
normalizer=lambda value: normalize_principal(value),
),
DateTime('krbprincipalexpiration?',
cli_name='principal_expiration',
label=_('Kerberos principal expiration'),
),
...
IMO, it should be rather "--principal" and "--principal-alias".
Martin

Bump.

I have fixed the CLI API a while ago so it should now be more conformant
with the rest of the framework. I just forgot to notify the list about
the change.

Other parts of the design were also revised but we are not there yet
since we have to investigate a discrepancy in handling of kinit using
alias without canonicalization between AD and MIT Kerberos.

We have discussed this with Simo (cc'ed) who promised to ask MIT guys
about this. We should restart the discussion about the design.